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A long-standing question is whether it is possible to delegate computational tasks securely. Recently, both a 
classical and a quantum solution to this problem were found [BID. Here, we study the interplay of classical and 
quantum approaches and show how coherence can be used as a tool for secure delegated classical computation. 

We show that a client with limited computational capacity—restricted to an XOR gate—can perform universal 
classical computation by manipulating information carriers that may occupy superpositions of two states. Using 
single photonic qubits or coherent light, we experimentally implement secure delegated classical computations 
between an independent client and a server. The server has access to the light sources and measurement devices, 
whereas the client may use only a restricted set of passive optical devices to manipulate the light beams. Thus, 
our work highlights how minimal quantum and classical resources can be combined and exploited for classical 
computing. 


INTRODUCTION 


Cloud computing, the storage and processing of data on 
remote servers, has become highly relevant to modem infor¬ 
mation processing. The question of whether it is possible to 
compute over encrypted data was first asked some 35 years 
ago m With the progress from stand-alone machines to 
large connected networks, the security of delegated compu¬ 
tations has become increasingly important. In 2009, a clas¬ 
sical algorithm, the fully homomorphic encryption protocol, 
was invented which provides computation security in data 
processing at remote servers Q. At the same time, a quan¬ 
tum computing protocol was found which allows an almost- 
classical client to delegate a quantum computation securely to 
a quantum server EH. In contrast to the classical algorithm, 
the quantum version provides unconditional security EUS- 
[ 71 ; however, it requires classical communication of the or¬ 
der of the size of the computation. The trade-off between 
the amount of communication required and the desired secu¬ 
rity level is what motivates evaluation of a hybrid quantum- 
classical scheme lO. 

Here, we study the interplay between classical and quan- 



FIG. I: Bit, cobits, and qubits. The bit is a two-level classical sys¬ 
tem, cobits are systems capable of being in a coherent superposition 
of two ’’states”, and qubits are quantum systems. The operation U 
transforms basis states into superposition states and vice versa. 


turn delegated computation. The central question is what kind 
of additional resources a client, with capability restricted only 
to parity computations (XOR), needs in order to perform uni¬ 
versal classical computations and to delegate those securely 
to a server. We show that this can be accomplished using co¬ 
bits, systems capable of being in a coherent superposition of 
two ’’states” (see Fig. [T]), for example single photonic qubits 
or coherent laser beams. 

In our scheme, the server has access to cobits, and the client 
is restricted to parity computations and the local manipulation 
of the cobits. The protocol works in the following manner: 
the server sends cobits, and the client applies simple opera¬ 
tions to them, dependent on some classical bits. The cobits are 
then sent back to the server, which performs a measurement. 
The result of the measurement depends on the client’s ma¬ 
nipulations and contains the encrypted outcome of the NAND 
operation on the client’s classical bits. This means that the 
cobit enables the client to compute problems beyond her own 
power, since the NAND gate is universal for classical compu¬ 
tation. 

Further, we experimentally implement classical secure del¬ 
egated computation by using single qubits or coherent laser 
beams as cobits. In our implementation, the client and the 
server are set up in two different laboratories, separated by 
more than 50 meters, and connected by optical fibres. Pho¬ 
tonic systems are ideally suited for this task, since they can 
be easily manipulated and transmitted over large distances; 
however our scheme can be implemented using every physi¬ 
cal system that provides coherence. 

Note that the protocol and the implementation are classi¬ 
cal in the sense of classical physics: they use purely classical 
means, effects and devices, including classical coherence. We 
note that this definition differs from the definition of ’’classi¬ 
cal” in computer science, which is limited to only classical 
two-level bits and gates on these bits. Thus, our work also 
highlights the two different notions of classicality in physics 
and computer science. 
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FIG. 2: Scheme of delegated NAND gate. The steps of the protocol 
are in detail described in the main text. 


THEORY 

Our work is based on a protocol for secure delegated clas¬ 
sical computation using quantum resources 0. It was shown 
that manipulations of only two-level bits are not sufficient for 
this task. Here, we reformulate the original work |(9l and show 
that in the same setting adding classical coherence enables us 
to perform secure delegated classical computations. 

The protocol is based on the implementation of a NAND 
gate using only parity computations and coherence. Here, we 
first describe the protocol using single cobits and show later 
its implementation with single photonic qubits and coherent 
beams, which relaxes the requirements of the initial theory (a. 
In detail, the protocol works as explained in the following (see 
also Fig|^. First, the server generates cobits in the state |0) 
and sends these cobits to the client. The client wants to im¬ 
plement a NAND gate on two input bits a and b. The client 
encodes the result of a NAND(a,b) gate in the output cobit by 
applying the gate sequence: 

|NAND(a, 6) 0 1) = (1) 

Here, U is an operation which brings the state |0) into a su¬ 
perposition of |0) and |1). If (7 is applied to the superposition 
of |0) and |1), the cobit will be in state |1) after the opera¬ 
tion (U{U\0)) = |1)). In our protocol, the operation U is or 
is not applied, depending on the values of a and b. Only if 
a = 6 = 1, the output cobit is in state 11), for all other settings 
of a and b, the output cobit is in state |0). Thus, the output 
cobit can be written as | NAND (a, 6) 0 1) and effectively con¬ 


tains a NAND gate. 

In order to hide the state of the output cobit to achieve se¬ 
cure delegated computing, the client applies an additional ran¬ 
dom bit flip X: 

|NAND(a, 6) 0 1 0 r) = XnNAND(a, 6) 0 1), (2) 

where r is a random value. 

The cobit is then sent back to the server, where a measure¬ 
ment in the |0/1) basis is performed. The result of this mea¬ 
surement, s, is returned to the client, who finally obtains the 
result NAND(a,b) by computing: 

NAND(a, 6) = 5 0 1 0 r. (3) 

A single classical bit is not sufficient to implement a NAND 
gate, because at least two bits are required. Our protocol 
shows that systems allowing for a coherent superposition of 
two states are sufficient. A single qubit also accomplishes 
this task in the fully quantum case. Here, the operation 
U = Ry{7r/2) is 3. rotation of 7r/2 around the Y axis of the 
Bloch sphere: Ry{0) = exp {—i0l2ay), ay is the Pauli oper¬ 
ator, and the bit flip X = ax is given by the Pauli operator . 
However, no quantum behavior is required in our setting. Ev¬ 
ery system that provides coherence can be used to implement 
our protocol. 

Optics facilitates transmission of information between the 
server and the client and back. Experimentally, we make use 
of single photonic qubits or a coherent laser beam, since the 
logical states |0) and |1) can be encoded in the photon’s or 
beam’s polarization. The only difference is that when using 
a coherent state light beam multiple photons pass through the 
client’s gates with the same settings. Since the security effec¬ 
tively reduces to a classical information-theoretical encryption 
(effectively a one-time pad) and is not relying on quantum 
properties vital in most of quantum cryptography (e.g. the no¬ 
cloning result for quantum states), having multiple copies of 
the same state does not reduce the security (see proof in SI). 

The challenge when single qubits are used for the proto¬ 
col is that probabilistic generation and optical losses affect 
the robustness of the protocol. Since the client is only capa¬ 
ble of performing parity computations and the preparation of 
random bits, she cannot check whether the computation is cor¬ 
rect or not. If the server does not send a photon or the photon 
gets lost, then the server fails to register a result. The easiest 
solution would be to send an additional classical bit on a dif¬ 
ferent channel from the server to the client, which indicates 
that the procedure has worked. Dependent on the classical bit, 
the client could then repeat the computation. However, this is 
not possible in our framework as this routine would be equiv¬ 
alent to implementing a NAND gate and thus is beyond the 
client’s capabilities. Using a laser beam for the implementa¬ 
tion of the protocol has the advantage of providing robustness 
against these photon losses. 

A NAND computation without considering the security as¬ 
pects, was first proposed in another work do). There, a 
classical parity computer controlled three-qubit Greenberger- 
Home-Zeilinger states in order to perform universal classical 
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FIG. 3: Experimental setup, a. Setup of separated client and server. 
The server in “lab 1” generates and measures polarization-encoded 
single qubits or the polarization of an attenuated laser beam. The 
client in “lab 2” manipulates the polarization and encodes the NAND 
gate. b. Source for the generation of heralded single photons. 

computation. This setting can be seen as a measurement- 
based version of ours—a rotation is performed via single¬ 
qubit measurements CHEl. Our work shows that the same 
functionality can be achieved without having any quantum 
resources at all. Furthermore, we achieve secure delegated 
computations by sending cobits. This reduction to the ma¬ 
nipulation of ’’simple” resources, compared to the generation 
of entanglement, clearly decreases the experimental require¬ 
ments and enables one to perform secure and delegated clas¬ 
sical computations with minimal resources. 


EXPERIMENTS 

We implement the server and the client using two indepen¬ 
dent experimental setups running in two different laboratories, 
which are separated by 50 m (see Fig.[^. 

We either use a heralded single photon source or a weak co¬ 
herent laser beam for the implementation of the protocol. For 
both cases, we encode the states |0) and |1) in polarization, 
denoting horizontal and vertical polarization, respectively. 

The heralded single photons are produced by type-II para¬ 
metric down conversion in a Potassium Titanium Oxide 
Phosphate (KTP) crystal that has periodically poled waveg¬ 
uides na. A mode-locked fiber-based femtosecond laser pro¬ 
duces 90 fs long pulses at 1575 nm with a repetition rate 
of 100 MHz. These pulses are frequency-doubled in a 1 
mm long periodically poled Potassium Dihydrogen Phosphate 
(KDP) crystal cut for type-II second harmonic generation, re¬ 
sulting in 7 mW of 787 nm light. The fundamental 1575 nm 
light is filtered out with a dichroic mirror and short-pass filter. 


and the 787 nm beam is focused through 3 /im wide waveg¬ 
uides in a 10 mm long AR-coated KTP crystal, which is pe¬ 
riodically poled to phase-match for type-II parametric down- 
conversion. After the chip, long-pass filters are used to block 
out the pump light. The horizontally and vertically polarized 
down-converted photons, centered at 1570 nm and 1580 nm, 
are split with a polarizing beam splitter cube. The photons are 
further filtered and coupled into single-mode fibers. The pho¬ 
tons at 1570 nm are guided to the client’s setup, whereas the 
photons at 1580 nm are kept the server’s side and produce the 
heralding signal. Alternatively, we use a coherent laser beam 
at 1550 nm that is attenuated to the single photon level. 

These polarization-encoded cobits are sent to the client who 
implements the required gates using wave plates. We show in 
the Supplementary Information (SI) that it is sufficient for the 
client to have access to three half-wave plates (HWP) for the 
implementation of the NAND gate and to one additional HWP 
for the implementation of the operation. By applying the 
following gate sequence: 

HWP((^''). HWP(-6»^“®'’^).HWP(6»“'’).HWP(6»“) (4) 

^ ^ ^ ^ ^ ^ 

X or \Z gate implementation 

with (f = tt/A and 0 = 7r/8, the client alters the output state, 
dependent on the values of a and b. The value of the ran¬ 
dom number r is generated via a classical computer in our 
implementation. However, this could be easily replaced by a 
quantum random number generator. 

The output cobit is send back to the server who performs a 
measurement in the computational basis. Experimentally, for 
both implementations, the polarization of the photons returned 
to the server is analyzed using a half-wave plate, a Glan- 
Thompson polarizer and InGaAs avalanche photo diodes that 
are specified to be 20% efficient and a deadtime set to 10 
/iS. The results of the server’s measurement is then equal to 
AND(a,b). 

Note, that a real physical implementation introduces state- 
dependent phase shifts, for example HWP(O) = (Tz- In order 
to avoid that these phase shifts reveal any information about 
a or 6, the settings have to be carefully chosen. As we show 
in the SI, the settings given above are secure in the sense, that 
these global phase shifts do not reveal any information about 
our computation. Further, additional phase shifts are intro¬ 
duced when the photons are sent through the fibers. These 
phase shifts are independent of the settings of a and b and do 
not affect the correctness of the computation. 

RESULTS 

We first implement the protocol with single photons. Since 
the protocol is secure even when multiple photons pass at the 
same time though the same settings (see SI), a single-shot im¬ 
plementation is not necessary and we integrate the result over 
10s of measurement time. In our experiment, we use a Glan- 
Thompson polarizer and an additional HWP for analysing the 
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FIG. 4: Results of delegated secure NAND gate. Implementation 
with single photons (top row) and with an attenuated laser beam (bot¬ 
tom row) for the cases r = 0 (left) and r = 1 (right). We achieve 
probabilities for finding the correct output of (98.8 zb 0.5) % for the 
single-photon implementation and of (98.2 zb 0.06) % for the imple¬ 
mentation with a coherent beam. 
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FIG. 5: Study of the long-term stability of our experiment. We re¬ 
peat the measurement sequence, shown in Fig.|^ six times over 210 
minutes and compute the average probability of obtaining the cor¬ 
rect result of the NAND computation (averaged over all results, for 
r = 0 and r = 1). Error bars are not shown as they are smaller than 
the symbols. 
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polarization. The results of the single-photon runs are shown 
in Fig.|^. We obtain count rates of 300 heralded photons per 
second. The average probability for finding the correct results 
is (98.8 ± 0.5) %. 

We run the same experimental sequence with a laser beam 
that is attenuated to 30000 single counts per second, measured 
after the transmission through the setup. In this experimental 
run, we obtain similar average probabilities of finding the cor¬ 
rect results of (98.2 ± 0.06) % (see detailed results in Fig. El)- 
In both experiments, the errors are calculated assuming Pois- 
sonian errors. Experimental imperfections arise from polar¬ 
izations drifts when the photons are transmitted through fibers 
and errors in the manipulations with wave plates as well as 
imperfection in the measurement in the |0,1) basis. 

The fibres connecting both laboratories are 50 m long and 
are placed partly outside the building. In order to test the long¬ 
term stability of our fibre connection and influences such as 
temperature changes and movements of the fibres, we per¬ 
form a series of NAND-gate measurements for all possible 
inputs and repeat this measurement six times over 210 min¬ 
utes. During this period, the obtained probabilities are stable 
and decrease only slightly from on average (98.2 ± 0.06) % to 
(97.1 ± 0.08) % (see Fig.|^. 

CONCLUSION 

In this work, we have studied secure delegated comput¬ 
ing at the boundary between classical and quantum physics. 
We have shown that the computational power of classical en¬ 
tity limited to parity computations can be boosted to univer¬ 
sal classical computation by exploiting coherence. We have 
shown that a single qubit can be used as a simple system to ac¬ 


complish this task—even though no quantumness is required. 
The extension of previous work to systems capable of being in 
a coherent superposition of two states provides a practical and 
robust way to implement the protocol experimentally while 
still being secure. 

We note that the protocol we present here is completely 
classical in the sense of classical physics. In a different set¬ 
ting, it could also be accomplished with a classical pointer in¬ 
stead of qubits and coherent beams. Here, the classical pointer 
represents a three-level system, which shows the same func¬ 
tionality than a two-level system with coherence. However, 
this would also require the client to have a different function¬ 
ality. 

While the focus of our work is more of fundamental na¬ 
ture, demonstrating the computational capability of cobits, a 
potential practical application of it could be also investigated 
in future. Note that any partial efficient classical solution for 
secure cloud computing once boosted to be universal would 
require a huge overhead. We intend to explore whether our 
scheme could be used as an alternative scheme where the more 
costly encoding for NAND computing is done via cobits. 

Furthermore, our implementation can be easily extended 
to long distances using standard technology from quantum 
key distribution. In the future, it will be interesting to study 
how this scheme can be extended to multi-party computations, 
where different parties compute a result while hiding the in¬ 
puts from each other. 

In conclusion, our work shows a new way of how to exploit 
the properties of both quantum particles and classical fields as 
tools for classical computing. 
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Supplementary Information 
Correctness of the experimental implementation 

The original protocol requires gates to be applied condi¬ 
tioned on the values of a and b m However, when using po¬ 
larization and wave plates, these might apply state-dependent 
phase shifts. For example, a half-wave plate (HWP) at “0” 
setting is equivalent to a az gate, at a setting of tt/S, it is a 
Hadamard gate, and at 7r/4 it is an ax gate. In order to avoid 
that these state-dependent phase shifts leak information to the 
server, we need to choose the settings carefully and ensure 
that the output state contains no information about a and b. 


To this end, we choose the following sequence for the im¬ 
plementation of the NAND gate: 

HWP(-6»^“®'’)).HWP(-6''’).HWP(6»“)|0), (5) 

with 0 = tt/S. For the settings a = 6 = 0, a = 0, 6 = 1, 
a = 1,6 = 0, this gate sequence adds an additional phase 
shift of TT to the state 11). This phase shift can be compensated 
if we incorporate an additional phase flip in our one-time pad. 
For this, we use another wave plate HWP((/:?’^) with p = it j 4, 
which allows us to randomly switch between a phase flip and 
a bit flip. Thus, we can implement the whole scheme using 
only four HWPs securely: 

HWP((^’').HWP(-6>(“®'’)).HWP(-6>'').HWP(6>“)|0) (6) 

with ip = 7r/4 and 0 = tt/S. 

Security of implementation using laser beams 

The security of the implemented protocol can follow imme¬ 
diately from the proof given in 121 under two assumptions: 

1. ideal devices and or devices with noise/loss, provided 
the noise/loss parameters are not controlled by the 
server. 

2. the malevolent server does send individual photon states 
in the modes that ensure the correct operation of the op¬ 
tical elements on the client’s side on the polarization de¬ 
grees of freedom of the photons, e.g. correct frequency 
of light. 

Next we show that the security is not jeopardized under a 
broader choice of malevolent activity by the server, which can 
be straightforwardly applied to the coherent light setting. 

The cumulative action of optical devices on the client’s side 
are easily seen to implement a polarization rotation of zero 
degrees, if NAND (a, 6) 0 r = 0, and tt otherwise. In other 
words, the map itself, implemented by the client, is classically 
one-time padded. Thus, irrespective of the of the actual state 
prepared by the server, the action of such a map results in a 
state that is one-time padded by the parameter r, so indepen¬ 
dent from the client’s inputs, when averaged over the client’s 
secret parameter r. The latter means the protocol is blind. 

We note that the security may be jeopardized if the server 
utilizes other modes, e.g. frequency of light, which changes 
how the optical devices, on the side of the client, manipulate 
the polarization degrees of freedom. However, such behavior 
can in principle be prevented by quality control, which spo¬ 
radically checks the characteristics of light used by the server. 
More general analyses of how particular implementations may 
be vulnerable to attacks are beyond the scope of this work. 



